Firefox · DOM
CVE-2026-2784
Logic Error in DOM
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifdom/fetch/FetchService.cpp |
modified |
Files Changed
dom/fetch/FetchParent.cppdom/fetch/FetchService.cppdom/fetch/FetchService.h
Patch
diff --git a/dom/fetch/FetchParent.cpp b/dom/fetch/FetchParent.cpp
index d7791cebac1..ef908084a56 100644
--- a/dom/fetch/FetchParent.cpp
+++ b/dom/fetch/FetchParent.cpp
@@ -176,7 +176,7 @@ IPCResult FetchParent::RecvFetchOp(FetchOpArgs&& aArgs) {
self->mResponsePromises =
fetchService->Fetch(AsVariant(FetchService::WorkerFetchArgs(
{self->mRequest.clonePtr(), self->mPrincipalInfo,
- self->mWorkerScript, self->mClientInfo, self->mController,
+ self->mWorkerScript, *self->mClientInfo, self->mController,
self->mCookieJarSettings, self->mNeedOnDataAvailable,
self->mCSPEventListener, self->mAssociatedBrowsingContextID,
self->mBackgroundEventTarget, self->mID,
@@ -189,6 +189,7 @@ IPCResult FetchParent::RecvFetchOp(FetchOpArgs&& aArgs) {
fetchService->Fetch(AsVariant(FetchService::MainThreadFetchArgs({
self->mRequest.clonePtr(),
self->mPrincipalInfo,
+ *self->mClientInfo,
self->mCookieJarSettings,
self->mNeedOnDataAvailable,
self->mCSPEventListener,
diff --git a/dom/fetch/FetchService.cpp b/dom/fetch/FetchService.cpp
index 13ad1f24ab1..14c8fb1a265 100644
--- a/dom/fetch/FetchService.cpp
+++ b/dom/fetch/FetchService.cpp
@@ -270,8 +270,7 @@ RefPtr<FetchServicePromises> FetchService::FetchInstance::Fetch() {
if (mArgsType == FetchArgsType::WorkerFetch) {
auto& args = mArgs.as<WorkerFetchArgs>();
mFetchDriver->SetWorkerScript(args.mWorkerScript);
- MOZ_ASSERT(args.mClientInfo.isSome());
- mFetchDriver->SetClientInfo(args.mClientInfo.ref());
+ mFetchDriver->SetClientInfo(args.mClientInfo);
mFetchDriver->SetController(args.mController);
if (args.mCSPEventListener) {
mFetchDriver->SetCSPEventListener(args.mCSPEventListener);
@@ -284,6 +283,7 @@ RefPtr<FetchServicePromises> FetchService::FetchInstance::Fetch() {
if (mArgsType == FetchArgsType::MainThreadFetch) {
auto& args = mArgs.as<MainThreadFetchArgs>();
+ mFetchDriver->SetClientInfo(args.mClientInfo);
mFetchDriver->SetAssociatedBrowsingContextID(
args.mAssociatedBrowsingContextID);
mFetchDriver->SetIsThirdPartyContext(Some(args.mIsThirdPartyContext));
diff --git a/dom/fetch/FetchService.h b/dom/fetch/FetchService.h
index 00dc76f6dae..c1c7edeea9a 100644
--- a/dom/fetch/FetchService.h
+++ b/dom/fetch/FetchService.h
@@ -108,7 +108,7 @@ class FetchService final : public nsIObserver {
SafeRefPtr<InternalRequest> mRequest;
mozilla::ipc::PrincipalInfo mPrincipalInfo;
nsCString mWorkerScript;
- Maybe<ClientInfo> mClientInfo;
+ ClientInfo mClientInfo;
Maybe<ServiceWorkerDescriptor> mController;
Maybe<net::CookieJarSettingsArgs> mCookieJarSettings;
bool mNeedOnDataAvailable;
@@ -131,6 +131,7 @@ class FetchService final : public nsIObserver {
struct MainThreadFetchArgs {
SafeRefPtr<InternalRequest> mRequest;
mozilla::ipc::PrincipalInfo mPrincipalInfo;
+ ClientInfo mClientInfo;
Maybe<net::CookieJarSettingsArgs> mCookieJarSettings;
bool mNeedOnDataAvailable;
nsCOMPtr<nsICSPEventListener> mCSPEventListener;
Loading diff…
References
On This Page