nsXMLContentSink::CloseElement captured the element’s NodeInfo into a raw, non-owning pointer: mozilla::dom::NodeInfo* nodeInfo = aContent->NodeInfo();. It then performs further work in the same function — notably calling DoneAddingChildren() and handling HTML elements that can execute script or run synchronous callbacks — before using nodeInfo again. Those intermediate operations can tear down the DOM subtree, drop the last strong reference to aContent, and thereby destroy its NodeInfo. Any subsequent dereference of the stale nodeInfo raw pointer in CloseElement is a use-after-free. The violated invariant is that a raw NodeInfo* obtained from NodeInfo() is only valid as long as the owning node is kept alive, which CloseElement did not guarantee across its own re-entrant callbacks.

The one-line patch changes the capture to an owning reference: RefPtr<mozilla::dom::NodeInfo> nodeInfo = aContent->NodeInfo();. The RefPtr takes a strong reference, so the NodeInfo survives even if aContent and the surrounding subtree are destroyed by script or DoneAddingChildren() side effects during CloseElement, eliminating the dangling access.

The bug is in the renderer/content process XML content sink and is reachable by loading attacker-controlled XML/XHTML. The attacker must arrange for a mutation (typically via script run during element close) that frees the element whose NodeInfo was captured — a plausible, content-controllable precondition rather than a race. The primitive is a use-after-free of a reference-counted NodeInfo; the advisory’s “use-after-free in the XML component” matches the diff. Escalation from the UAF to code execution is inferred and not demonstrated by the diff.