High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionJIT miscompilation in the DOM: Core & HTML component
ComponentDOM
Bug ClassLogic Error
Tracker2043139
Fix commit72649967bc7b (firefox) +9/-12
CISA KEVNot listed
CreditedHyeonjun Ahn
Disclosed2026-06-16

Files Changed

  • dom/webidl/Document.webidl
  • dom/webidl/EditContext.webidl
  • dom/webidl/Element.webidl
  • dom/webidl/HTMLElement.webidl
  • dom/webidl/HTMLInputElement.webidl
diff --git a/dom/webidl/Document.webidl b/dom/webidl/Document.webidl
index 03284d1f13c..944864e0b28 100644
--- a/dom/webidl/Document.webidl
+++ b/dom/webidl/Document.webidl
@@ -669,7 +669,7 @@ partial interface Document {
    * tracking, fingerprinting, cryptomining and so on. This method is for
    * testing only.
    */
-  [ChromeOnly, Pure]
+  [ChromeOnly]
   readonly attribute NodeList blockedNodesByClassifier;
 };
 
diff --git a/dom/webidl/EditContext.webidl b/dom/webidl/EditContext.webidl
index 2f7df1c2c69..8d1c3808bde 100644
--- a/dom/webidl/EditContext.webidl
+++ b/dom/webidl/EditContext.webidl
@@ -25,7 +25,6 @@ interface EditContext : EventTarget {
     undefined updateSelectionBounds(DOMRect selectionBounds);
     undefined updateCharacterBounds(unsigned long rangeStart, sequence<DOMRect> characterBounds);
 
-    [Pure]
     sequence<HTMLElement> attachedElements();
 
     [Pure]
@@ -36,7 +35,6 @@ interface EditContext : EventTarget {
     readonly attribute unsigned long selectionEnd;
     [Pure]
     readonly attribute unsigned long characterBoundsRangeStart;
-    [Pure]
     sequence<DOMRect> characterBounds();
 
     attribute EventHandler ontextupdate;
diff --git a/dom/webidl/Element.webidl b/dom/webidl/Element.webidl
index 90c4a004958..aceb70aeebb 100644
--- a/dom/webidl/Element.webidl
+++ b/dom/webidl/Element.webidl
@@ -39,7 +39,6 @@ interface Element : Node {
 
   [SameObject]
   readonly attribute NamedNodeMap attributes;
-  [Pure]
   sequence<DOMString> getAttributeNames();
   [Pure]
   DOMString? getAttribute(DOMString name);
@@ -365,7 +364,7 @@ partial interface Element {
    * properties, as well as a property that exposes the flex lines
    * in this container.
    */
-  [ChromeOnly, Pure]
+  [ChromeOnly]
   Flex? getAsFlexContainer();
 
   // Support reporting of Grid properties
@@ -374,13 +373,13 @@ partial interface Element {
    * this property returns an object with computed values for grid
    * tracks and lines.
    */
-  [ChromeOnly, Pure]
+  [ChromeOnly]
   sequence<Grid> getGridFragments();
 
   /**
    * Returns whether there are any grid fragments on this element.
    */
-  [ChromeOnly, Pure]
+  [ChromeOnly]
   boolean hasGridFragments();
 
   /**
@@ -388,7 +387,7 @@ partial interface Element {
    * that have display:grid or display:inline-grid style and generate
    * a frame.
    */
-  [ChromeOnly, Pure]
+  [ChromeOnly]
   sequence<Element> getElementsWithGrid();
 
   /**
diff --git a/dom/webidl/HTMLElement.webidl b/dom/webidl/HTMLElement.webidl
index 034aa0de194..e5d4fea347e 100644
--- a/dom/webidl/HTMLElement.webidl
+++ b/dom/webidl/HTMLElement.webidl
@@ -25,9 +25,9 @@ interface HTMLElement : Element {
   [CEReactions, SetterThrows, Pure]
            attribute DOMString dir;
 
-  [CEReactions, GetterThrows, Pure]
+  [CEReactions, GetterThrows]
            attribute [LegacyNullToEmptyString] DOMString innerText;
-  [CEReactions, GetterThrows, SetterThrows, Pure]
+  [CEReactions, GetterThrows, SetterThrows]
            attribute [LegacyNullToEmptyString] DOMString outerText;
 
   // user interaction
diff --git a/dom/webidl/HTMLInputElement.webidl b/dom/webidl/HTMLInputElement.webidl
index be41ed49406..09964a99669 100644
--- a/dom/webidl/HTMLInputElement.webidl
+++ b/dom/webidl/HTMLInputElement.webidl
@@ -59,7 +59,7 @@ interface HTMLInputElement : HTMLElement {
            attribute boolean formNoValidate;
   [CEReactions, Pure, SetterThrows]
            attribute DOMString formTarget;
-  [CEReactions, Pure, SetterThrows]
+  [CEReactions, SetterThrows]
            attribute unsigned long height;
   [Pure]
            attribute boolean indeterminate;
@@ -215,7 +215,7 @@ interface mixin MozEditableElement {
   // Returns an nsIEditor instance which is associated with the element.
   // If the element can be associated with an editor but not yet created,
   // this creates new one automatically.
-  [Pure, ChromeOnly, BinaryName="editorForBindings"]
+  [ChromeOnly, BinaryName="editorForBindings"]
   readonly attribute nsIEditor? editor;
 
   // Returns true if an nsIEditor instance has already been associated with
Loading diff…