Firefox · Layout
CVE-2026-117879
Logic Error in Layout
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
iflayout/tables/nsTableFrame.cpp |
modified | |
fortesting/web-platform/tests/css/css-tables/table-continuation-border-model-crash-print.html |
modified |
Files Changed
layout/tables/nsTableFrame.cpptesting/web-platform/tests/css/css-tables/table-continuation-border-model-crash-print.html
Patch
diff --git a/layout/tables/nsTableFrame.cpp b/layout/tables/nsTableFrame.cpp
index 52a862bb55f..e7b9322bf90 100644
--- a/layout/tables/nsTableFrame.cpp
+++ b/layout/tables/nsTableFrame.cpp
@@ -168,10 +168,12 @@ void nsTableFrame::Init(nsIContent* aContent, nsContainerFrame* aParent,
// Let the base class do its processing
nsContainerFrame::Init(aContent, aParent, aPrevInFlow);
- // see if border collapse is on, if so set it
- const nsStyleTableBorder* tableStyle = StyleTableBorder();
- bool borderCollapse =
- (StyleBorderCollapse::Collapse == tableStyle->mBorderCollapse);
+ // Continuations share the first-in-flow's cell map and cell frame types.
+ // Keep their border model consistent even if their computed styles differ.
+ const bool borderCollapse =
+ aPrevInFlow ? static_cast<nsTableFrame*>(aPrevInFlow)->IsBorderCollapse()
+ : StyleTableBorder()->mBorderCollapse ==
+ StyleBorderCollapse::Collapse;
SetBorderCollapse(borderCollapse);
if (borderCollapse) {
SetNeedToCalcHasBCBorders(true);
diff --git a/testing/web-platform/tests/css/css-tables/table-continuation-border-model-crash-print.html b/testing/web-platform/tests/css/css-tables/table-continuation-border-model-crash-print.html
new file mode 100644
index 00000000000..1b4cec925b3
--- /dev/null
+++ b/testing/web-platform/tests/css/css-tables/table-continuation-border-model-crash-print.html
@@ -0,0 +1,36 @@
+<!doctype html>
+<meta charset="utf-8">
+<!--
+ This is really a crashtest, so we just ensure we don't render blank.
+-->
+<link rel="mismatch" href="/common/blank.html">
+<link rel="help" href="https://drafts.csswg.org/css-tables/">
+<link rel="help" href="https://bugzilla.mozilla.org/show_bug.cgi?id=2075432">
+<style>
+ * { margin: 0; padding: 0; }
+ #container { --border-model: separate; --border-color: blue; }
+ #container::first-line {
+ --border-model: collapse;
+ --border-color: red;
+ }
+ table { float: left; border-collapse: var(--border-model); }
+ td { border: 4px solid var(--border-color); }
+ tr { height: 30px; break-inside: avoid; }
+ @media print {
+ tr { border-top: 4px solid; }
+ col { border-right: 2px solid; }
+ #cell { container-type: inline-size; }
+ }
+ @page { size: 400px 220px; margin: 0; }
+</style>
+<div id="container"><span>Y<table cellspacing="3">
+ <col><col><col><col><col>
+ <thead><tr><td>Header<td>Header<td>Header<td>Header<td>Header</thead>
+ <tbody id="rows"></tbody>
+</table></span></div>
+<script>
+ for (let i = 0; i < 12; ++i) {
+ rows.insertAdjacentHTML("beforeend",
+ `<tr><td>A<td>B<td ${i === 9 ? 'id="cell"' : ''}>${i}<td>D<td>E</tr>`);
+ }
+</script>
Loading diff…
Regression Test / PoC
shipped with the fix
diff --git a/testing/web-platform/tests/css/css-tables/table-continuation-border-model-crash-print.html b/testing/web-platform/tests/css/css-tables/table-continuation-border-model-crash-print.html
new file mode 100644
index 00000000000..1b4cec925b3
--- /dev/null
+++ b/testing/web-platform/tests/css/css-tables/table-continuation-border-model-crash-print.html
@@ -0,0 +1,36 @@
+<!doctype html>
+<meta charset="utf-8">
+<!--
+ This is really a crashtest, so we just ensure we don't render blank.
+-->
+<link rel="mismatch" href="/common/blank.html">
+<link rel="help" href="https://drafts.csswg.org/css-tables/">
+<link rel="help" href="https://bugzilla.mozilla.org/show_bug.cgi?id=2075432">
+<style>
+ * { margin: 0; padding: 0; }
+ #container { --border-model: separate; --border-color: blue; }
+ #container::first-line {
+ --border-model: collapse;
+ --border-color: red;
+ }
+ table { float: left; border-collapse: var(--border-model); }
+ td { border: 4px solid var(--border-color); }
+ tr { height: 30px; break-inside: avoid; }
+ @media print {
+ tr { border-top: 4px solid; }
+ col { border-right: 2px solid; }
+ #cell { container-type: inline-size; }
+ }
+ @page { size: 400px 220px; margin: 0; }
+</style>
+<div id="container"><span>Y<table cellspacing="3">
+ <col><col><col><col><col>
+ <thead><tr><td>Header<td>Header<td>Header<td>Header<td>Header</thead>
+ <tbody id="rows"></tbody>
+</table></span></div>
+<script>
+ for (let i = 0; i < 12; ++i) {
+ rows.insertAdjacentHTML("beforeend",
+ `<tr><td>A<td>B<td ${i === 9 ? 'id="cell"' : ''}>${i}<td>D<td>E</tr>`);
+ }
+</script>
Loading diff…
References
On This Page