Firefox · Layout
CVE-2026-118013
Logic Error in Layout
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
iflayout/generic/nsSubDocumentFrame.cpp |
modified |
Files Changed
layout/generic/nsSubDocumentFrame.cpp
Patch
diff --git a/layout/generic/nsSubDocumentFrame.cpp b/layout/generic/nsSubDocumentFrame.cpp
index 7c55235845e..59e06e56ff9 100644
--- a/layout/generic/nsSubDocumentFrame.cpp
+++ b/layout/generic/nsSubDocumentFrame.cpp
@@ -162,6 +162,7 @@ void nsSubDocumentFrame::Init(nsIContent* aContent, nsContainerFrame* aParent,
}
void nsSubDocumentFrame::UpdateEmbeddedBrowsingContextDependentData() {
+ MOZ_ASSERT(!nsContentUtils::IsSafeToRunScript());
if (!mFrameLoader) {
return;
}
@@ -201,24 +202,25 @@ void nsSubDocumentFrame::ShowViewer() {
if (!frameloader->IsRemoteFrame() && !PresContext()->IsDynamic()) {
// We let the printing code take care of loading the document and
// initializing the shell.
- } else {
- AutoWeakFrame weakThis(this);
- mCallingShow = true;
- bool didCreateDoc = frameloader->Show(this);
- if (!weakThis.IsAlive()) {
- return;
- }
- mCallingShow = false;
- mDidCreateDoc = didCreateDoc;
- if (!HasAnyStateBits(NS_FRAME_FIRST_REFLOW)) {
- frameloader->UpdatePositionAndSize(this);
- }
- if (!weakThis.IsAlive()) {
- return;
- }
- UpdateEmbeddedBrowsingContextDependentData();
- InvalidateFrame();
+ return;
}
+ AutoWeakFrame weakThis(this);
+ mCallingShow = true;
+ bool didCreateDoc = frameloader->Show(this);
+ if (!weakThis.IsAlive()) {
+ return;
+ }
+ mCallingShow = false;
+ mDidCreateDoc = didCreateDoc;
+ if (!HasAnyStateBits(NS_FRAME_FIRST_REFLOW)) {
+ frameloader->UpdatePositionAndSize(this);
+ }
+ if (!weakThis.IsAlive()) {
+ return;
+ }
+ nsAutoScriptBlocker sb;
+ UpdateEmbeddedBrowsingContextDependentData();
+ InvalidateFrame();
}
Document* nsSubDocumentFrame::GetExtantSubdocument() {
Loading diff…
References
On This Page