Firefox · DOM
CVE-2026-109711
Logic Error in DOM
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifdom/canvas/CanvasRenderingContext2D.cpp |
modified |
Files Changed
dom/canvas/CanvasRenderingContext2D.cpp
Patch
diff --git a/dom/canvas/CanvasRenderingContext2D.cpp b/dom/canvas/CanvasRenderingContext2D.cpp
index f7abe9c40c0..a9be24964c1 100644
--- a/dom/canvas/CanvasRenderingContext2D.cpp
+++ b/dom/canvas/CanvasRenderingContext2D.cpp
@@ -5559,8 +5559,26 @@ gfxFontGroup* CanvasRenderingContext2D::GetCurrentFontStyle() {
if (currentFont.IsEmpty()) {
currentFont = kDefaultFontStyle;
}
- if (!SetFontInternal(currentFont, err) || err.Failed()) {
- err.SuppressException();
+
+ bool fontWasSet = SetFontInternal(currentFont, err) && !err.Failed();
+ err.SuppressException();
+ // SetFontInternal may flush and run script, which could change or
+ // destroy the current PresShell.
+ if (GetPresShell() != presShell || (presShell && presShell->IsDestroying())) {
+ // We can't rely on the cached fontGroup (which uses the old PresShell).
+ // Mark fontWasSet false so we create the fontGroup, and clear out the
+ // possibly stale pointers we use to create a new fontGroup.
+ fontWasSet = false;
+ presShell = GetPresShell();
+ presContext = presShell ? presShell->GetPresContext() : nullptr;
+ if (presContext) {
+ visProvider = presContext;
+ } else {
+ visProvider = mOffscreenCanvas;
+ }
+ }
+
+ if (!fontWasSet) {
// XXX Should we get a default lang from the prescontext or something?
nsAtom* language = nsGkAtoms::x_western;
bool explicitLanguage = false;
Loading diff…
References
On This Page