High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionUse-after-free in the SVG component
ComponentLayout
Bug ClassLogic Error
Tracker2074212
Fix commit0c9c88d0d378 (firefox) +8/-0
CISA KEVNot listed
CreditedMozilla
Disclosed2026-10-13

Changed Functions

FunctionChangeNotes
if
layout/svg/SVGObserverUtils.cpp
modified

Files Changed

  • layout/svg/SVGObserverUtils.cpp
diff --git a/layout/svg/SVGObserverUtils.cpp b/layout/svg/SVGObserverUtils.cpp
index 190f5fc50e2..9075fa68fad 100644
--- a/layout/svg/SVGObserverUtils.cpp
+++ b/layout/svg/SVGObserverUtils.cpp
@@ -1330,6 +1330,7 @@ NS_DECLARE_FRAME_PROPERTY_RELEASABLE(OffsetPathProperty,
 template <class T>
 static T* GetEffectProperty(SVGReference* aReference, nsIFrame* aFrame,
                             const FramePropertyDescriptor<T>* aProperty) {
+  MOZ_ASSERT(!aFrame->GetPrevContinuation(), "Require first continuation");
   if (!aReference) {
     return nullptr;
   }
@@ -1392,6 +1393,7 @@ static SVGFilterObserverListForCSSProp* GetOrCreateFilterObserverListForCSS(
     nsIFrame* aFrame, bool aHasFilters,
     FrameProperties::Descriptor<P> aProperty,
     Span<const StyleFilter> aFilters) {
+  MOZ_ASSERT(!aFrame->GetPrevContinuation(), "Require first continuation");
   if (!aHasFilters) {
     return nullptr;
   }
@@ -1729,6 +1731,9 @@ void SVGObserverUtils::RemoveTemplateObserver(nsIFrame* aFrame) {
 
 Element* SVGObserverUtils::GetAndObserveBackgroundImage(nsIFrame* aFrame,
                                                         const nsAtom* aHref) {
+  // Continuations can come and go during reflow, and we don't need to observe
+  // the referenced element more than once for a given node.
+  aFrame = aFrame->FirstContinuation();
   URIObserverHashtable* hashtable =
       aFrame->GetOrCreateDeletableProperty(BackgroundImageProperty());
   nsAutoString localRef = u"#"_ns + nsDependentAtomString(aHref);
@@ -1750,6 +1755,9 @@ Element* SVGObserverUtils::GetAndObserveBackgroundImage(nsIFrame* aFrame,
 }
 
 Element* SVGObserverUtils::GetAndObserveBackgroundClip(nsIFrame* aFrame) {
+  // Continuations can come and go during reflow, and we don't need to observe
+  // the referenced element more than once for a given node.
+  aFrame = aFrame->FirstContinuation();
   BackgroundClipRenderingObserver* obs = aFrame->GetOrCreateReleasableProperty(
       BackgroundClipObserverProperty(), aFrame);
   return obs->GetAndObserveReferencedElement();
Loading diff…