High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionUse-after-free in the Layout component
ComponentLayout
Bug ClassLogic Error
Tracker2082009
Fix commit1fb5606f16d9 (firefox) +67/-2
CISA KEVNot listed
CreditedOpenAI Codex Security (kylebot)
Disclosed2026-10-27

Files Changed

  • layout/base/nsCSSFrameConstructor.cpp
  • testing/web-platform/tests/css/printing/fixed-generated-content-whitespace-crash-print.html
  • testing/web-platform/tests/css/printing/repeated-generated-content-whitespace-crash-print.html
diff --git a/layout/base/nsCSSFrameConstructor.cpp b/layout/base/nsCSSFrameConstructor.cpp
index ae355fcc99f..a4a41d60ddd 100644
--- a/layout/base/nsCSSFrameConstructor.cpp
+++ b/layout/base/nsCSSFrameConstructor.cpp
@@ -7337,6 +7337,10 @@ nsIFrame* nsCSSFrameConstructor::CreateContinuingTableFrame(
 
       nsIContent* headerFooter = rowGroupFrame->GetContent();
       headerFooterFrame->Init(headerFooter, newFrame, nullptr);
+      if (rowGroupFrame->HasAnyStateBits(NS_FRAME_GENERATED_CONTENT)) {
+        headerFooterFrame->AddStateBits(NS_FRAME_GENERATED_CONTENT);
+        state.mAdditionalStateBits |= NS_FRAME_GENERATED_CONTENT;
+      }
 
       nsFrameConstructorSaveState absoluteSaveState;
       MakeTablePartAbsoluteContainingBlock(state, absoluteSaveState,
@@ -7582,10 +7586,13 @@ nsresult nsCSSFrameConstructor::ReplicateFixedFrames(
       nsIContent* content = fixed->GetContent();
       ComputedStyle* computedStyle =
           nsLayoutUtils::GetStyleFrame(content)->Style();
+      ItemFlags flags{ItemFlag::AllowPageBreak};
+      if (fixed->HasAnyStateBits(NS_FRAME_GENERATED_CONTENT)) {
+        flags += ItemFlag::IsGeneratedContent;
+      }
       AutoFrameConstructionItemList items(this);
       AddFrameConstructionItemsInternal(state, content, canvasFrame, true,
-                                        computedStyle,
-                                        {ItemFlag::AllowPageBreak}, items);
+                                        computedStyle, flags, items);
       ConstructFramesFromItemList(state, items, canvasFrame,
                                   /* aParentIsWrapperAnonBox = */ false,
                                   fixedPlaceholders);
diff --git a/testing/web-platform/tests/css/printing/fixed-generated-content-whitespace-crash-print.html b/testing/web-platform/tests/css/printing/fixed-generated-content-whitespace-crash-print.html
new file mode 100644
index 00000000000..c29c3de4986
--- /dev/null
+++ b/testing/web-platform/tests/css/printing/fixed-generated-content-whitespace-crash-print.html
@@ -0,0 +1,26 @@
+<!doctype html>
+<meta charset="utf-8">
+<title>Changing generated text in a replicated fixed-position pseudo</title>
+<link rel="author" title="Emilio Cobos Álvarez" href="mailto:emilio@crisal.io">
+<link rel="author" title="Mozilla" href="https://mozilla.org">
+<link rel="help" href="https://bugzilla.mozilla.org/show_bug.cgi?id=2081977">
+<!-- Really a crashtest but since we can't really have print crashtests, we assert that we print something -->
+<link rel="mismatch" href="/css/reference/blank.html">
+<style>
+@page { size: 360px 420px; margin: 15px; }
+body { font-size: 12px; }
+#box { container: box / inline-size; width: 220px; }
+#target::before, #target::after {
+  position: fixed;
+  top: 0;
+  left: 0;
+  display: ruby;
+  content: "a";
+}
+@container box (min-width: 100px) {
+  #target::before, #target::after { content: " "; }
+}
+.spacer { height: 2000px; }
+</style>
+<div id="box"><div id="target"></div></div>
+<div class="spacer">hello</div>
diff --git a/testing/web-platform/tests/css/printing/repeated-generated-content-whitespace-crash-print.html b/testing/web-platform/tests/css/printing/repeated-generated-content-whitespace-crash-print.html
new file mode 100644
index 00000000000..ab074f7062d
--- /dev/null
+++ b/testing/web-platform/tests/css/printing/repeated-generated-content-whitespace-crash-print.html
@@ -0,0 +1,32 @@
+<!doctype html>
+<meta charset="utf-8">
+<title>Changing generated text in a repeated table header and footer</title>
+<link rel="author" title="Emilio Cobos Álvarez" href="mailto:emilio@crisal.io">
+<link rel="author" title="Mozilla" href="https://mozilla.org">
+<link rel="help" href="https://bugzilla.mozilla.org/show_bug.cgi?id=2081977">
+<!-- Really a crashtest but since we can't really have print crashtests, we assert that we print something -->
+<link rel="mismatch" href="/css/reference/blank.html">
+<style>
+@page { size: 360px 420px; margin: 15px; }
+body { font-size: 12px; }
+#box { container: box / inline-size; width: 220px; }
+table { width: 100%; }
+table::before { display: table-header-group; content: "a"; }
+table::after { display: table-footer-group; content: "a"; }
+@container box (min-width: 100px) {
+  table::before, table::after { content: " "; }
+}
+td { height: 180px; }
+</style>
+<div id="box">
+  <table>
+    <tr><td>one</td></tr>
+    <tr><td>two</td></tr>
+    <tr><td>three</td></tr>
+    <tr><td>four</td></tr>
+    <tr><td>five</td></tr>
+    <tr><td>six</td></tr>
+    <tr><td>seven</td></tr>
+    <tr><td>eight</td></tr>
+  </table>
+</div>
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/testing/web-platform/tests/css/printing/fixed-generated-content-whitespace-crash-print.html b/testing/web-platform/tests/css/printing/fixed-generated-content-whitespace-crash-print.html
new file mode 100644
index 00000000000..c29c3de4986
--- /dev/null
+++ b/testing/web-platform/tests/css/printing/fixed-generated-content-whitespace-crash-print.html
@@ -0,0 +1,26 @@
+<!doctype html>
+<meta charset="utf-8">
+<title>Changing generated text in a replicated fixed-position pseudo</title>
+<link rel="author" title="Emilio Cobos Álvarez" href="mailto:emilio@crisal.io">
+<link rel="author" title="Mozilla" href="https://mozilla.org">
+<link rel="help" href="https://bugzilla.mozilla.org/show_bug.cgi?id=2081977">
+<!-- Really a crashtest but since we can't really have print crashtests, we assert that we print something -->
+<link rel="mismatch" href="/css/reference/blank.html">
+<style>
+@page { size: 360px 420px; margin: 15px; }
+body { font-size: 12px; }
+#box { container: box / inline-size; width: 220px; }
+#target::before, #target::after {
+  position: fixed;
+  top: 0;
+  left: 0;
+  display: ruby;
+  content: "a";
+}
+@container box (min-width: 100px) {
+  #target::before, #target::after { content: " "; }
+}
+.spacer { height: 2000px; }
+</style>
+<div id="box"><div id="target"></div></div>
+<div class="spacer">hello</div>
diff --git a/testing/web-platform/tests/css/printing/repeated-generated-content-whitespace-crash-print.html b/testing/web-platform/tests/css/printing/repeated-generated-content-whitespace-crash-print.html
new file mode 100644
index 00000000000..ab074f7062d
--- /dev/null
+++ b/testing/web-platform/tests/css/printing/repeated-generated-content-whitespace-crash-print.html
@@ -0,0 +1,32 @@
+<!doctype html>
+<meta charset="utf-8">
+<title>Changing generated text in a repeated table header and footer</title>
+<link rel="author" title="Emilio Cobos Álvarez" href="mailto:emilio@crisal.io">
+<link rel="author" title="Mozilla" href="https://mozilla.org">
+<link rel="help" href="https://bugzilla.mozilla.org/show_bug.cgi?id=2081977">
+<!-- Really a crashtest but since we can't really have print crashtests, we assert that we print something -->
+<link rel="mismatch" href="/css/reference/blank.html">
+<style>
+@page { size: 360px 420px; margin: 15px; }
+body { font-size: 12px; }
+#box { container: box / inline-size; width: 220px; }
+table { width: 100%; }
+table::before { display: table-header-group; content: "a"; }
+table::after { display: table-footer-group; content: "a"; }
+@container box (min-width: 100px) {
+  table::before, table::after { content: " "; }
+}
+td { height: 180px; }
+</style>
+<div id="box">
+  <table>
+    <tr><td>one</td></tr>
+    <tr><td>two</td></tr>
+    <tr><td>three</td></tr>
+    <tr><td>four</td></tr>
+    <tr><td>five</td></tr>
+    <tr><td>six</td></tr>
+    <tr><td>seven</td></tr>
+    <tr><td>eight</td></tr>
+  </table>
+</div>
Loading diff…