Firefox · DOM
CVE-2026-100780
Logic Error in DOM
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifdom/base/Document.cpp |
modified |
Files Changed
dom/base/Document.cppdom/base/Document.h
Patch
diff --git a/dom/base/Document.cpp b/dom/base/Document.cpp
index d8085b5d35f..da23f9e50d0 100644
--- a/dom/base/Document.cpp
+++ b/dom/base/Document.cpp
@@ -15918,27 +15918,36 @@ static uint32_t CountFullscreenSubDocuments(Document& aDoc) {
}
bool Document::IsFullscreenLeaf() {
- // A fullscreen leaf document is fullscreen, and has no fullscreen
- // subdocuments.
- //
- // FIXME(emilio): This doesn't seem to account for fission iframes, is that
- // ok?
- return Fullscreen() && CountFullscreenSubDocuments(*this) == 0;
+ // A fullscreen leaf document is fullscreen, and its fullscreen element does
+ // not embed another in-process fullscreen document, i.e. it is at the bottom
+ // of the fullscreen document chain. Other subdocuments may still be
+ // fullscreen without being part of that chain, for example when this document
+ // has more than one fullscreen element in its top layer.
+ Element* fsElement = GetUnretargetedFullscreenElement();
+ if (!fsElement) {
+ return false;
+ }
+
+ Document* subDoc = GetSubDocumentFor(fsElement);
+ if (!subDoc) {
+ return true;
+ }
+
+ return !subDoc->Fullscreen();
}
/* static */ Document* Document::GetFullscreenLeaf(Document& aDoc) {
if (aDoc.IsFullscreenLeaf()) {
return &aDoc;
}
- if (!aDoc.Fullscreen()) {
+ Element* fsElement = aDoc.GetUnretargetedFullscreenElement();
+ if (!fsElement) {
return nullptr;
}
- Document* leaf = nullptr;
- aDoc.EnumerateSubDocuments([&leaf](Document& aSubDoc) {
- leaf = GetFullscreenLeaf(aSubDoc);
- return leaf ? CallState::Stop : CallState::Continue;
- });
- return leaf;
+ Document* subDoc = aDoc.GetSubDocumentFor(fsElement);
+ MOZ_ASSERT(subDoc);
+ MOZ_ASSERT(subDoc->Fullscreen());
+ return GetFullscreenLeaf(*subDoc);
}
/* static */ Document* Document::GetFullscreenLeaf(Document* aDoc) {
@@ -15953,8 +15962,6 @@ bool Document::IsFullscreenLeaf() {
static CallState ResetFullscreen(Document& aDocument) {
if (Element* fsElement = aDocument.GetUnretargetedFullscreenElement()) {
- NS_ASSERTION(CountFullscreenSubDocuments(aDocument) <= 1,
- "Should have at most 1 fullscreen subdocument.");
aDocument.CleanupFullscreenState();
NS_ASSERTION(!aDocument.Fullscreen(), "Should reset fullscreen");
DispatchFullscreenChange(aDocument, fsElement);
@@ -16129,7 +16136,8 @@ void Document::RestorePreviousFullscreenState(UniquePtr<FullscreenExit> aExit) {
Document* lastDoc = exitElements.LastElement()->OwnerDoc();
size_t fullscreenCount = lastDoc->CountFullscreenElements();
- if (!lastDoc->GetInProcessParentDocument() && fullscreenCount == 1) {
+ if ((!lastDoc->GetInProcessParentDocument() && fullscreenCount == 1) ||
+ GetFullscreenLeaf(lastDoc) != fullScreenDoc) {
// If we are fully exiting fullscreen, don't touch anything here,
// just wait for the window to get out from fullscreen first.
PendingFullscreenChangeList::Add(std::move(aExit));
@@ -16929,8 +16937,6 @@ void Document::RemoteFrameFullscreenReverted() {
static bool HasFullscreenSubDocument(Document& aDoc) {
uint32_t count = CountFullscreenSubDocuments(aDoc);
- NS_ASSERTION(count <= 1,
- "Fullscreen docs should have at most 1 fullscreen child!");
return count >= 1;
}
diff --git a/dom/base/Document.h b/dom/base/Document.h
index 82bbb321b84..9dffe87e101 100644
--- a/dom/base/Document.h
+++ b/dom/base/Document.h
@@ -2139,8 +2139,11 @@ class Document : public nsINode,
UniquePtr<FullscreenExit>);
/**
- * Returns true if this document is a fullscreen leaf document, i.e. it
- * is in fullscreen mode and has no fullscreen children.
+ * Returns true if this document is a fullscreen leaf document, i.e. it is
+ * in fullscreen mode and its current fullscreen element does not embed
+ * another in-process fullscreen document. Note that this document may still
+ * have other fullscreen subdocuments which are not part of the current
+ * fullscreen document chain.
*/
bool IsFullscreenLeaf();
Loading diff…
References
On This Page