Firefox · Layout
CVE-2026-117938
Logic Error in Layout
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
layout/base/nsCSSFrameConstructor.cpptesting/web-platform/tests/css/printing/fixed-generated-content-whitespace-crash-print.htmltesting/web-platform/tests/css/printing/repeated-generated-content-whitespace-crash-print.html
Patch
diff --git a/layout/base/nsCSSFrameConstructor.cpp b/layout/base/nsCSSFrameConstructor.cpp
index ae355fcc99f..a4a41d60ddd 100644
--- a/layout/base/nsCSSFrameConstructor.cpp
+++ b/layout/base/nsCSSFrameConstructor.cpp
@@ -7337,6 +7337,10 @@ nsIFrame* nsCSSFrameConstructor::CreateContinuingTableFrame(
nsIContent* headerFooter = rowGroupFrame->GetContent();
headerFooterFrame->Init(headerFooter, newFrame, nullptr);
+ if (rowGroupFrame->HasAnyStateBits(NS_FRAME_GENERATED_CONTENT)) {
+ headerFooterFrame->AddStateBits(NS_FRAME_GENERATED_CONTENT);
+ state.mAdditionalStateBits |= NS_FRAME_GENERATED_CONTENT;
+ }
nsFrameConstructorSaveState absoluteSaveState;
MakeTablePartAbsoluteContainingBlock(state, absoluteSaveState,
@@ -7582,10 +7586,13 @@ nsresult nsCSSFrameConstructor::ReplicateFixedFrames(
nsIContent* content = fixed->GetContent();
ComputedStyle* computedStyle =
nsLayoutUtils::GetStyleFrame(content)->Style();
+ ItemFlags flags{ItemFlag::AllowPageBreak};
+ if (fixed->HasAnyStateBits(NS_FRAME_GENERATED_CONTENT)) {
+ flags += ItemFlag::IsGeneratedContent;
+ }
AutoFrameConstructionItemList items(this);
AddFrameConstructionItemsInternal(state, content, canvasFrame, true,
- computedStyle,
- {ItemFlag::AllowPageBreak}, items);
+ computedStyle, flags, items);
ConstructFramesFromItemList(state, items, canvasFrame,
/* aParentIsWrapperAnonBox = */ false,
fixedPlaceholders);
diff --git a/testing/web-platform/tests/css/printing/fixed-generated-content-whitespace-crash-print.html b/testing/web-platform/tests/css/printing/fixed-generated-content-whitespace-crash-print.html
new file mode 100644
index 00000000000..c29c3de4986
--- /dev/null
+++ b/testing/web-platform/tests/css/printing/fixed-generated-content-whitespace-crash-print.html
@@ -0,0 +1,26 @@
+<!doctype html>
+<meta charset="utf-8">
+<title>Changing generated text in a replicated fixed-position pseudo</title>
+<link rel="author" title="Emilio Cobos Álvarez" href="mailto:[email protected]">
+<link rel="author" title="Mozilla" href="https://mozilla.org">
+<link rel="help" href="https://bugzilla.mozilla.org/show_bug.cgi?id=2081977">
+<!-- Really a crashtest but since we can't really have print crashtests, we assert that we print something -->
+<link rel="mismatch" href="/css/reference/blank.html">
+<style>
+@page { size: 360px 420px; margin: 15px; }
+body { font-size: 12px; }
+#box { container: box / inline-size; width: 220px; }
+#target::before, #target::after {
+ position: fixed;
+ top: 0;
+ left: 0;
+ display: ruby;
+ content: "a";
+}
+@container box (min-width: 100px) {
+ #target::before, #target::after { content: " "; }
+}
+.spacer { height: 2000px; }
+</style>
+<div id="box"><div id="target"></div></div>
+<div class="spacer">hello</div>
diff --git a/testing/web-platform/tests/css/printing/repeated-generated-content-whitespace-crash-print.html b/testing/web-platform/tests/css/printing/repeated-generated-content-whitespace-crash-print.html
new file mode 100644
index 00000000000..ab074f7062d
--- /dev/null
+++ b/testing/web-platform/tests/css/printing/repeated-generated-content-whitespace-crash-print.html
@@ -0,0 +1,32 @@
+<!doctype html>
+<meta charset="utf-8">
+<title>Changing generated text in a repeated table header and footer</title>
+<link rel="author" title="Emilio Cobos Álvarez" href="mailto:[email protected]">
+<link rel="author" title="Mozilla" href="https://mozilla.org">
+<link rel="help" href="https://bugzilla.mozilla.org/show_bug.cgi?id=2081977">
+<!-- Really a crashtest but since we can't really have print crashtests, we assert that we print something -->
+<link rel="mismatch" href="/css/reference/blank.html">
+<style>
+@page { size: 360px 420px; margin: 15px; }
+body { font-size: 12px; }
+#box { container: box / inline-size; width: 220px; }
+table { width: 100%; }
+table::before { display: table-header-group; content: "a"; }
+table::after { display: table-footer-group; content: "a"; }
+@container box (min-width: 100px) {
+ table::before, table::after { content: " "; }
+}
+td { height: 180px; }
+</style>
+<div id="box">
+ <table>
+ <tr><td>one</td></tr>
+ <tr><td>two</td></tr>
+ <tr><td>three</td></tr>
+ <tr><td>four</td></tr>
+ <tr><td>five</td></tr>
+ <tr><td>six</td></tr>
+ <tr><td>seven</td></tr>
+ <tr><td>eight</td></tr>
+ </table>
+</div>
Loading diff…
Regression Test / PoC
shipped with the fix
diff --git a/testing/web-platform/tests/css/printing/fixed-generated-content-whitespace-crash-print.html b/testing/web-platform/tests/css/printing/fixed-generated-content-whitespace-crash-print.html new file mode 100644 index 00000000000..c29c3de4986 --- /dev/null +++ b/testing/web-platform/tests/css/printing/fixed-generated-content-whitespace-crash-print.html @@ -0,0 +1,26 @@ +<!doctype html> +<meta charset="utf-8"> +<title>Changing generated text in a replicated fixed-position pseudo</title> +<link rel="author" title="Emilio Cobos Álvarez" href="mailto:[email protected]"> +<link rel="author" title="Mozilla" href="https://mozilla.org"> +<link rel="help" href="https://bugzilla.mozilla.org/show_bug.cgi?id=2081977"> +<!-- Really a crashtest but since we can't really have print crashtests, we assert that we print something --> +<link rel="mismatch" href="/css/reference/blank.html"> +<style> +@page { size: 360px 420px; margin: 15px; } +body { font-size: 12px; } +#box { container: box / inline-size; width: 220px; } +#target::before, #target::after { + position: fixed; + top: 0; + left: 0; + display: ruby; + content: "a"; +} +@container box (min-width: 100px) { + #target::before, #target::after { content: " "; } +} +.spacer { height: 2000px; } +</style> +<div id="box"><div id="target"></div></div> +<div class="spacer">hello</div> diff --git a/testing/web-platform/tests/css/printing/repeated-generated-content-whitespace-crash-print.html b/testing/web-platform/tests/css/printing/repeated-generated-content-whitespace-crash-print.html new file mode 100644 index 00000000000..ab074f7062d --- /dev/null +++ b/testing/web-platform/tests/css/printing/repeated-generated-content-whitespace-crash-print.html @@ -0,0 +1,32 @@ +<!doctype html> +<meta charset="utf-8"> +<title>Changing generated text in a repeated table header and footer</title> +<link rel="author" title="Emilio Cobos Álvarez" href="mailto:[email protected]"> +<link rel="author" title="Mozilla" href="https://mozilla.org"> +<link rel="help" href="https://bugzilla.mozilla.org/show_bug.cgi?id=2081977"> +<!-- Really a crashtest but since we can't really have print crashtests, we assert that we print something --> +<link rel="mismatch" href="/css/reference/blank.html"> +<style> +@page { size: 360px 420px; margin: 15px; } +body { font-size: 12px; } +#box { container: box / inline-size; width: 220px; } +table { width: 100%; } +table::before { display: table-header-group; content: "a"; } +table::after { display: table-footer-group; content: "a"; } +@container box (min-width: 100px) { + table::before, table::after { content: " "; } +} +td { height: 180px; } +</style> +<div id="box"> + <table> + <tr><td>one</td></tr> + <tr><td>two</td></tr> + <tr><td>three</td></tr> + <tr><td>four</td></tr> + <tr><td>five</td></tr> + <tr><td>six</td></tr> + <tr><td>seven</td></tr> + <tr><td>eight</td></tr> + </table> +</div>
Loading diff…
References
On This Page