High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionIncorrect boundary conditions in the Layout: Grid component
ComponentLayout
Bug ClassLogic Error
Tracker2063893
Fix commite33f852a2064 (firefox) +15/-11
CISA KEVNot listed
CreditedIrvan Kurniawan
Disclosed2026-09-01

Changed Functions

FunctionChangeNotes
for
layout/generic/nsGridContainerFrame.cpp
modified
if
layout/generic/nsGridContainerFrame.cpp
modified

Files Changed

  • layout/generic/nsGridContainerFrame.cpp
diff --git a/layout/generic/nsGridContainerFrame.cpp b/layout/generic/nsGridContainerFrame.cpp
index 848d138e09c..15c011ea0d2 100644
--- a/layout/generic/nsGridContainerFrame.cpp
+++ b/layout/generic/nsGridContainerFrame.cpp
@@ -8307,14 +8307,16 @@ nscoord nsGridContainerFrame::ReflowInFragmentainer(
 
   // Set |endRow| to the first row that doesn't fit.
   uint32_t endRow = numRows;
-  for (uint32_t row = startRow; row < numRows; ++row) {
-    auto& sz = aGridRI.mRows.mSizes[row];
-    const nscoord bEnd = sz.mPosition + sz.mBase;
-    nscoord remainingAvailableSize = childAvailableSize - bEnd;
-    if (remainingAvailableSize < 0 ||
-        (isBDBClone && remainingAvailableSize < bpBEnd)) {
-      endRow = row;
-      break;
+  if (childAvailableSize != NS_UNCONSTRAINEDSIZE) {
+    for (uint32_t row = startRow; row < numRows; ++row) {
+      auto& sz = aGridRI.mRows.mSizes[row];
+      const nscoord bEnd = sz.mPosition + sz.mBase;
+      nscoord remainingAvailableSize = childAvailableSize - bEnd;
+      if (remainingAvailableSize < 0 ||
+          (isBDBClone && remainingAvailableSize < bpBEnd)) {
+        endRow = row;
+        break;
+      }
     }
   }
 
@@ -8405,8 +8407,10 @@ nscoord nsGridContainerFrame::ReflowInFragmentainer(
         aGridRI.mReflowInput->ComputedBSize());
   }
 
-  // Check for overflow and set aStatus INCOMPLETE if so.
-  bool overflow = bSize + bpBEnd > childAvailableSize;
+  // Check for overflow and set aStatus INCOMPLETE if so. Note that we should
+  // not overflow an unconstrained available block-size.
+  const bool overflow = childAvailableSize != NS_UNCONSTRAINEDSIZE &&
+                        bSize + bpBEnd > childAvailableSize;
   if (overflow) {
     if (avoidBreakInside) {
       aStatus.SetInlineLineBreakBeforeAndReset();
@@ -8467,7 +8471,7 @@ nscoord nsGridContainerFrame::ReflowInFragmentainer(
       aStatus.SetOverflowIncomplete();
       aStatus.SetNextInFlowNeedsReflow();
     }
-  } else {
+  } else if (childAvailableSize != NS_UNCONSTRAINEDSIZE) {
     // Children always have the full size of the rows in this fragment.
     childAvailableSize = std::max(childAvailableSize, bEndRow);
   }
Loading diff…