Firefox · Core
CVE-2026-118010
Logic Error in Core
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
accessible/generic/DocAccessible.cpp
Patch
diff --git a/accessible/generic/DocAccessible.cpp b/accessible/generic/DocAccessible.cpp
index ace3e38efd0..56eb0bd1142 100644
--- a/accessible/generic/DocAccessible.cpp
+++ b/accessible/generic/DocAccessible.cpp
@@ -2627,6 +2627,15 @@ void DocAccessible::ContentRemoved(LocalAccessible* aChild) {
aChild, nullptr);
#endif
+ if (aChild->IsRelocated()) {
+ nsTArray<RefPtr<LocalAccessible>>* owned = mARIAOwnsHash.Get(parent);
+ MOZ_ASSERT(owned, "IsRelocated flag is out of sync with mARIAOwnsHash");
+ owned->RemoveElement(aChild);
+ if (owned->Length() == 0) {
+ mARIAOwnsHash.Remove(parent);
+ }
+ }
+
// XXX: event coalescence may kill us
RefPtr<LocalAccessible> kungFuDeathGripChild(aChild);
@@ -2639,17 +2648,7 @@ void DocAccessible::ContentRemoved(LocalAccessible* aChild) {
return;
}
- MOZ_DIAGNOSTIC_ASSERT(aChild->LocalParent(), "Alive but unparented #1");
-
- if (aChild->IsRelocated()) {
- nsTArray<RefPtr<LocalAccessible>>* owned = mARIAOwnsHash.Get(parent);
- MOZ_ASSERT(owned, "IsRelocated flag is out of sync with mARIAOwnsHash");
- owned->RemoveElement(aChild);
- if (owned->Length() == 0) {
- mARIAOwnsHash.Remove(parent);
- }
- }
- MOZ_DIAGNOSTIC_ASSERT(aChild->LocalParent(), "Unparented #2");
+ MOZ_DIAGNOSTIC_ASSERT(aChild->LocalParent(), "Alive but unparented");
UncacheChildrenInSubtree(aChild);
parent->RemoveChild(aChild);
Loading diff…
References
On This Page