Firefox · DOM
CVE-2026-117921
Logic Error in DOM
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
iflayout/style/Rule.h |
modified | |
GetParentRuleForBindingslayout/style/nsICSSDeclaration.cpp |
modified |
Files Changed
dom/webidl/CSSRule.webidldom/webidl/CSSStyleDeclaration.webidllayout/style/Rule.cpplayout/style/Rule.hlayout/style/StyleSheet.cpplayout/style/StyleSheet.hlayout/style/nsICSSDeclaration.cpplayout/style/nsICSSDeclaration.h
Patch
diff --git a/dom/webidl/CSSRule.webidl b/dom/webidl/CSSRule.webidl
index 2a1370e6ce2..ae2ecfeadd1 100644
--- a/dom/webidl/CSSRule.webidl
+++ b/dom/webidl/CSSRule.webidl
@@ -26,7 +26,7 @@ interface CSSRule {
const unsigned short NAMESPACE_RULE = 10;
[BinaryName="typeForBindings"] readonly attribute unsigned short type;
attribute UTF8String cssText;
- readonly attribute CSSRule? parentRule;
+ [BinaryName="parentRuleForBindings"] readonly attribute CSSRule? parentRule;
readonly attribute CSSStyleSheet? parentStyleSheet;
};
diff --git a/dom/webidl/CSSStyleDeclaration.webidl b/dom/webidl/CSSStyleDeclaration.webidl
index ac4444e4de1..1b5e8bfeff6 100644
--- a/dom/webidl/CSSStyleDeclaration.webidl
+++ b/dom/webidl/CSSStyleDeclaration.webidl
@@ -32,5 +32,5 @@ interface CSSStyleDeclaration {
[ChromeOnly]
boolean hasLonghandProperty(UTF8String property);
- readonly attribute CSSRule? parentRule;
+ [BinaryName="parentRuleForBindings"] readonly attribute CSSRule? parentRule;
};
diff --git a/layout/style/Rule.cpp b/layout/style/Rule.cpp
index 802232124e8..d6f8acade1e 100644
--- a/layout/style/Rule.cpp
+++ b/layout/style/Rule.cpp
@@ -91,6 +91,10 @@ void Rule::SetCssText(const nsACString& aCssText) {
Rule* Rule::GetParentRule() const { return mParentRule; }
+already_AddRefed<Rule> Rule::GetParentRuleForBindings() const {
+ return do_AddRef(mParentRule);
+}
+
#ifdef DEBUG
void Rule::AssertParentRuleType() {
// Would be nice to check that this->Type() is StyleCssRuleType::Keyframe
diff --git a/layout/style/Rule.h b/layout/style/Rule.h
index 838d8b2d590..f61aeadc260 100644
--- a/layout/style/Rule.h
+++ b/layout/style/Rule.h
@@ -102,6 +102,7 @@ class Rule : public nsISupports, public nsWrapperCache, public SupportsWeakPtr {
virtual void GetCssText(nsACString& aCssText) const = 0;
void SetCssText(const nsACString& aCssText);
Rule* GetParentRule() const;
+ already_AddRefed<Rule> GetParentRuleForBindings() const;
StyleSheet* GetParentStyleSheet() const { return GetStyleSheet(); }
nsINode* GetAssociatedDocumentOrShadowRoot() const {
if (!mSheet) {
diff --git a/layout/style/StyleSheet.cpp b/layout/style/StyleSheet.cpp
index eac28c06f78..22d493369c7 100644
--- a/layout/style/StyleSheet.cpp
+++ b/layout/style/StyleSheet.cpp
@@ -548,7 +548,9 @@ void StyleSheet::GetSourceURL(nsACString& aSourceURL) {
Servo_StyleSheet_GetSourceURL(mInner->mContents, &aSourceURL);
}
-css::Rule* StyleSheet::GetDOMOwnerRule() const { return GetOwnerRule(); }
+already_AddRefed<css::Rule> StyleSheet::GetDOMOwnerRule() const {
+ return do_AddRef(GetOwnerRule());
+}
// https://drafts.csswg.org/cssom/#dom-cssstylesheet-insertrule
// https://wicg.github.io/construct-stylesheets/#dom-cssstylesheet-insertrule
diff --git a/layout/style/StyleSheet.h b/layout/style/StyleSheet.h
index 978e36112db..7480ff39743 100644
--- a/layout/style/StyleSheet.h
+++ b/layout/style/StyleSheet.h
@@ -339,7 +339,7 @@ class StyleSheet final : public nsICSSLoaderObserver, public nsWrapperCache {
// Can't be inline because we can't include ImportRule here. And can't be
// called GetOwnerRule because that would be ambiguous with the ImportRule
// version.
- css::Rule* GetDOMOwnerRule() const;
+ already_AddRefed<css::Rule> GetDOMOwnerRule() const;
dom::CSSRuleList* GetCssRules(nsIPrincipal& aSubjectPrincipal, ErrorResult&);
uint32_t InsertRule(const nsACString& aRule, uint32_t aIndex,
nsIPrincipal& aSubjectPrincipal, ErrorResult& aRv);
diff --git a/layout/style/nsICSSDeclaration.cpp b/layout/style/nsICSSDeclaration.cpp
index f7a151ff90c..19ff52089c8 100644
--- a/layout/style/nsICSSDeclaration.cpp
+++ b/layout/style/nsICSSDeclaration.cpp
@@ -20,6 +20,11 @@ DocGroup* nsICSSDeclaration::GetDocGroup() {
return parentNode->GetDocGroup();
}
+already_AddRefed<mozilla::css::Rule>
+nsICSSDeclaration::GetParentRuleForBindings() {
+ return do_AddRef(GetParentRule());
+}
+
bool nsICSSDeclaration::IsReadOnly() {
mozilla::css::Rule* rule = GetParentRule();
return rule && rule->IsReadOnly();
diff --git a/layout/style/nsICSSDeclaration.h b/layout/style/nsICSSDeclaration.h
index 5c98842b4c1..9b0853f09b3 100644
--- a/layout/style/nsICSSDeclaration.h
+++ b/layout/style/nsICSSDeclaration.h
@@ -98,6 +98,7 @@ class nsICSSDeclaration : public nsISupports, public nsWrapperCache {
virtual void GetPropertyPriority(const nsACString& aPropName,
nsACString& aPriority) = 0;
virtual mozilla::css::Rule* GetParentRule() = 0;
+ already_AddRefed<mozilla::css::Rule> GetParentRuleForBindings();
// [Chrome only]
virtual bool HasLonghandProperty(const nsACString& aPropName) {
Loading diff…
References
On This Page