High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionUse-after-free in the DOM: Editor component
ComponentCore
Bug ClassLogic Error
Tracker2079053
Fix commit8d2b3da7e72c (firefox) +18/-5
CISA KEVNot listed
CreditedMozilla
Disclosed2026-10-27

Changed Functions

FunctionChangeNotes
if
editor/libeditor/HTMLAnonymousNodeEditor.cpp
modified

Files Changed

  • editor/libeditor/HTMLAnonymousNodeEditor.cpp
diff --git a/editor/libeditor/HTMLAnonymousNodeEditor.cpp b/editor/libeditor/HTMLAnonymousNodeEditor.cpp
index 67064d4bbee..6ebea711b1c 100644
--- a/editor/libeditor/HTMLAnonymousNodeEditor.cpp
+++ b/editor/libeditor/HTMLAnonymousNodeEditor.cpp
@@ -172,8 +172,12 @@ ManualNACPtr HTMLEditor::CreateAnonymousElement(nsAtom* aTag,
     return nullptr;
   }
 
-  if (NS_WARN_IF(!GetDocument())) {
-    return nullptr;
+  {
+    Document* const doc = GetDocument();
+    if (NS_WARN_IF(!doc) ||
+        NS_WARN_IF(aParentContent.GetComposedDoc() != doc)) {
+      return nullptr;
+    }
   }
 
   RefPtr<PresShell> presShell = GetPresShell();
@@ -563,9 +567,12 @@ nsresult HTMLEditor::GetPositionAndDimensions(Element& aElement, int32_t& aX,
     nsAutoString positionValue;
     DebugOnly<nsresult> rvIgnored = CSSEditUtils::GetComputedProperty(
         aElement, *nsGkAtoms::position, positionValue);
-    if (NS_WARN_IF(Destroyed())) {
+    if (NS_WARN_IF(Destroyed())) [[unlikely]] {
       return NS_ERROR_EDITOR_DESTROYED;
     }
+    if (NS_WARN_IF(aElement.OwnerDoc() != GetDocument())) [[unlikely]] {
+      return NS_ERROR_EDITOR_UNEXPECTED_DOM_TREE;
+    }
     NS_WARNING_ASSERTION(NS_SUCCEEDED(rvIgnored),
                          "CSSEditUtils::GetComputedProperty(nsGkAtoms::"
                          "position) failed, but ignored");
@@ -579,7 +586,13 @@ nsresult HTMLEditor::GetPositionAndDimensions(Element& aElement, int32_t& aX,
     // Get the all the computed css styles attached to the element node
     RefPtr<nsComputedDOMStyle> computedDOMStyle =
         CSSEditUtils::GetComputedStyle(&aElement);
-    if (NS_WARN_IF(!computedDOMStyle)) {
+    if (NS_WARN_IF(Destroyed())) [[unlikely]] {
+      return NS_ERROR_EDITOR_DESTROYED;
+    }
+    if (NS_WARN_IF(aElement.OwnerDoc() != GetDocument())) [[unlikely]] {
+      return NS_ERROR_EDITOR_UNEXPECTED_DOM_TREE;
+    }
+    if (NS_WARN_IF(!computedDOMStyle)) [[unlikely]] {
       return NS_ERROR_FAILURE;
     }
 
@@ -597,7 +610,7 @@ nsresult HTMLEditor::GetPositionAndDimensions(Element& aElement, int32_t& aX,
     mResizedObjectIsAbsolutelyPositioned = false;
     RefPtr<nsGenericHTMLElement> htmlElement =
         nsGenericHTMLElement::FromNode(aElement);
-    if (!htmlElement) {
+    if (NS_WARN_IF(!htmlElement)) [[unlikely]] {
       return NS_ERROR_NULL_POINTER;
     }
     DebugOnly<nsresult> rvIgnored = GetElementOrigin(aElement, aX, aY);
Loading diff…