Firefox · Core
CVE-2026-92025
Logic Error in Core
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
mTooltipShownOncedocshell/base/nsDocShellTreeOwner.cpp |
modified | |
ifdocshell/base/nsDocShellTreeOwner.cpp |
modified |
Files Changed
docshell/base/nsDocShellTreeOwner.cpp
Patch
diff --git a/docshell/base/nsDocShellTreeOwner.cpp b/docshell/base/nsDocShellTreeOwner.cpp
index 8356647a0d9..521d93f3919 100644
--- a/docshell/base/nsDocShellTreeOwner.cpp
+++ b/docshell/base/nsDocShellTreeOwner.cpp
@@ -966,7 +966,11 @@ ChromeTooltipListener::ChromeTooltipListener(nsWebBrowser* aInBrowser,
mShowingTooltip(false),
mTooltipShownOnce(false) {}
-ChromeTooltipListener::~ChromeTooltipListener() = default;
+ChromeTooltipListener::~ChromeTooltipListener() {
+ if (mTooltipTimer) {
+ mTooltipTimer->Cancel();
+ }
+}
nsITooltipTextProvider* ChromeTooltipListener::GetTooltipTextProvider() {
if (!mTooltipTextProvider) {
@@ -1229,7 +1233,8 @@ bool ChromeTooltipListener::WebProgressShowedTooltip(
// -- the dom node the user hovered over (mPossibleTooltipNode)
void ChromeTooltipListener::sTooltipCallback(nsITimer* aTimer,
void* aChromeTooltipListener) {
- auto* self = static_cast<ChromeTooltipListener*>(aChromeTooltipListener);
+ RefPtr<ChromeTooltipListener> self =
+ static_cast<ChromeTooltipListener*>(aChromeTooltipListener);
if (!self || !self->mPossibleTooltipNode) {
return;
}
@@ -1268,8 +1273,9 @@ void ChromeTooltipListener::sTooltipCallback(nsITimer* aTimer,
getter_Copies(tooltipText),
getter_Copies(directionText), &textFound);
- if (textFound && (!self->mTooltipShownOnce ||
- tooltipText != self->mLastShownTooltipText)) {
+ if (self->mPossibleTooltipNode && textFound &&
+ (!self->mTooltipShownOnce ||
+ tooltipText != self->mLastShownTooltipText)) {
// ShowTooltip expects screen-relative position.
self->ShowTooltip(self->mMouseScreenPoint.x, self->mMouseScreenPoint.y,
tooltipText, directionText);
Loading diff…
References
On This Page