Firefox · Core
CVE-2026-12314
Logic Error in Core
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifparser/html/nsHtml5TreeOperation.cpp |
modified |
Files Changed
parser/html/nsHtml5TreeOperation.cpp
Patch
diff --git a/parser/html/nsHtml5TreeOperation.cpp b/parser/html/nsHtml5TreeOperation.cpp
index 50e386c8fce..afee91c2050 100644
--- a/parser/html/nsHtml5TreeOperation.cpp
+++ b/parser/html/nsHtml5TreeOperation.cpp
@@ -296,6 +296,8 @@ nsresult nsHtml5TreeOperation::Append(nsIContent* aNode, nsIContent* aParent,
return NS_OK;
}
+ Maybe<AutoSetThrowOnDynamicMarkupInsertionCounter>
+ throwOnDynamicMarkupInsertionCounter;
Maybe<nsHtml5AutoPauseUpdate> autoPause;
Maybe<AutoCEReaction> autoCEReaction;
DocGroup* docGroup = aParent->OwnerDoc()->GetDocGroup();
@@ -308,6 +310,7 @@ nsresult nsHtml5TreeOperation::Append(nsIContent* aNode, nsIContent* aParent,
if (autoCEReaction.isSome() && docGroup &&
docGroup->CustomElementReactionsStack()
->IsElementQueuePushedForCurrentRecursionDepth()) {
+ throwOnDynamicMarkupInsertionCounter.emplace(aBuilder->GetDocument());
autoPause.emplace(aBuilder);
}
return rv;
@@ -582,7 +585,7 @@ nsIContent* nsHtml5TreeOperation::CreateHTMLElement(
if (customElementDefinition) {
// This will cause custom element constructors to run.
AutoSetThrowOnDynamicMarkupInsertionCounter
- throwOnDynamicMarkupInsertionCounter(document);
+ throwOnDynamicMarkupInsertionCounter(aBuilder->GetDocument());
nsHtml5AutoPauseUpdate autoPauseContentUpdate(aBuilder);
{
nsAutoMicroTask mt;
Loading diff…
References
On This Page