Firefox · DOM
CVE-2026-117931
Logic Error in DOM
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
dom/ipc/CoalescedInputData.hdom/ipc/CoalescedMouseData.cppdom/ipc/CoalescedTouchData.cpp
Patch
diff --git a/dom/ipc/CoalescedInputData.h b/dom/ipc/CoalescedInputData.h
index a19da20d835..e3482269bac 100644
--- a/dom/ipc/CoalescedInputData.h
+++ b/dom/ipc/CoalescedInputData.h
@@ -88,6 +88,8 @@ class CoalescedInputFlusher : public nsARefreshObserver {
protected:
virtual ~CoalescedInputFlusher();
+ // BrowserChild owns us and unregisters us from the refresh driver in
+ // DestroyWindow() before it can go away.
BrowserChild* mBrowserChild;
// A refresh driver which this instance waits for the next refresh of.
RefPtr<nsRefreshDriver> mRefreshDriver;
diff --git a/dom/ipc/CoalescedMouseData.cpp b/dom/ipc/CoalescedMouseData.cpp
index def5cdd6967..ac5a2b05026 100644
--- a/dom/ipc/CoalescedMouseData.cpp
+++ b/dom/ipc/CoalescedMouseData.cpp
@@ -112,8 +112,9 @@ CoalescedMouseMoveFlusher::CoalescedMouseMoveFlusher(
void CoalescedMouseMoveFlusher::WillRefresh(mozilla::TimeStamp aTime) {
MOZ_ASSERT(mRefreshDriver);
- mBrowserChild->FlushAllCoalescedMouseData();
- mBrowserChild->ProcessPendingCoalescedMouseDataAndDispatchEvents();
+ RefPtr<BrowserChild> browserChild(mBrowserChild);
+ browserChild->FlushAllCoalescedMouseData();
+ browserChild->ProcessPendingCoalescedMouseDataAndDispatchEvents();
}
CoalescedMouseMoveFlusher::~CoalescedMouseMoveFlusher() { RemoveObserver(); }
diff --git a/dom/ipc/CoalescedTouchData.cpp b/dom/ipc/CoalescedTouchData.cpp
index 70e38b01477..f130ccc1b21 100644
--- a/dom/ipc/CoalescedTouchData.cpp
+++ b/dom/ipc/CoalescedTouchData.cpp
@@ -134,7 +134,8 @@ Touch* CoalescedTouchData::GetTouch(int32_t aIdentifier) {
void CoalescedTouchMoveFlusher::WillRefresh(mozilla::TimeStamp aTime) {
MOZ_ASSERT(mRefreshDriver);
- mBrowserChild->ProcessPendingCoalescedTouchData();
+ RefPtr<BrowserChild> browserChild(mBrowserChild);
+ browserChild->ProcessPendingCoalescedTouchData();
}
CoalescedTouchMoveFlusher::CoalescedTouchMoveFlusher(
Loading diff…
References
On This Page