High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionUse-after-free in the Layout: Text and Fonts component
ComponentGraphics
Bug ClassLogic Error
Tracker2079057
Fix commit1e643a857bfb (firefox) +12/-1
CISA KEVNot listed
CreditedMozilla
Disclosed2026-10-27

Changed Functions

FunctionChangeNotes
if
gfx/thebes/gfxPlatformFontList.h
modified
gfxUserFontSet
gfx/thebes/gfxUserFontSet.h
modified

Files Changed

  • gfx/thebes/gfxPlatformFontList.h
  • gfx/thebes/gfxUserFontSet.h
diff --git a/gfx/thebes/gfxPlatformFontList.h b/gfx/thebes/gfxPlatformFontList.h
index 66290cd7044..4719c99e05d 100644
--- a/gfx/thebes/gfxPlatformFontList.h
+++ b/gfx/thebes/gfxPlatformFontList.h
@@ -554,11 +554,16 @@ class gfxPlatformFontList : public gfxFontInfoLoader {
   // Keep track of userfont sets to notify when global fontlist changes occur.
   void AddUserFontSet(gfxUserFontSet* aUserFontSet) {
     AutoLock lock(mLock);
-    mUserFontSetList.Insert(aUserFontSet);
+    if (!aUserFontSet->mDestroying) {
+      mUserFontSetList.Insert(aUserFontSet);
+    }
   }
 
+  // Called from the font-set destructor, to notify that the set is being
+  // destroyed and should no longer be tracked here.
   void RemoveUserFontSet(gfxUserFontSet* aUserFontSet) {
     AutoLock lock(mLock);
+    aUserFontSet->mDestroying = true;
     mUserFontSetList.Remove(aUserFontSet);
   }
 
diff --git a/gfx/thebes/gfxUserFontSet.h b/gfx/thebes/gfxUserFontSet.h
index 5a7e0b5348b..d5f329bcff9 100644
--- a/gfx/thebes/gfxUserFontSet.h
+++ b/gfx/thebes/gfxUserFontSet.h
@@ -264,6 +264,7 @@ struct gfxUserFontAttributes {
 class gfxUserFontSet {
   friend class gfxUserFontEntry;
   friend class gfxOTSMessageContext;
+  friend class gfxPlatformFontList;
 
  public:
   using FontWidth = mozilla::FontWidth;
@@ -562,6 +563,11 @@ class gfxUserFontSet {
   // true when rules using local names need to be redone
   bool mRebuildLocalRules;
 
+  // Set when this font-set is being destroyed, to prevent re-adding it to the
+  // gfxPlatformFontList's list of active font sets.
+  // Guarded by the platform font-list lock.
+  bool mDestroying = false;
+
   // performance stats
   uint32_t mDownloadCount;
   uint64_t mDownloadSize;
Loading diff…