Firefox · Layout
CVE-2026-7323
Memory Corruption in Layout
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
layout/generic/nsInlineFrame.cpp
Patch
diff --git a/layout/generic/nsInlineFrame.cpp b/layout/generic/nsInlineFrame.cpp
index 7664c3c68ab..9a55a9f7124 100644
--- a/layout/generic/nsInlineFrame.cpp
+++ b/layout/generic/nsInlineFrame.cpp
@@ -925,7 +925,15 @@ void nsInlineFrame::UpdateStyleOfOwnedAnonBoxesForIBSplit(
}
nsIFrame* nextInline = blockFrame->GetProperty(nsIFrame::IBSplitSibling());
- MOZ_ASSERT(nextInline, "There is always a trailing inline in an IB split");
+ if (MOZ_UNLIKELY(!nextInline)) {
+ MOZ_ASSERT_UNREACHABLE(
+ "There should always a be trailing inline "
+ "in an IB split");
+ // Gracefully bail so that nextInline usage below doesn't
+ // null-deref. (We can stop worrying about this when we remove
+ // IB split siblings in bug 2031448.)
+ return;
+ }
for (nsIFrame* cont = nextInline; cont;
cont = cont->GetNextContinuation()) {
Loading diff…
References
On This Page